Subject: [Sidrops] New Version Notification for draft-ymbk-sidrops-ov-egress-00.txt

From: [email-masked]
Date: Thu, 03 Jan 2019 13:55:23 -0800

A new version of I-D, draft-ymbk-sidrops-ov-egress-00.txt
has been successfully submitted by Randy Bush and posted to the
IETF repository.

Name:		draft-ymbk-sidrops-ov-egress
Revision:	00
Title:		BGP RPKI-Based Origin Validation on Export
Document date:	2019-01-03
Group:		Individual Submission
Pages:		4
URL:            https://www.ietf.org/internet-drafts/draft-ymbk-sidrops-ov-egress-00.txt
Status:         https://datatracker.ietf.org/doc/draft-ymbk-sidrops-ov-egress/
Htmlized:       https://tools.ietf.org/html/draft-ymbk-sidrops-ov-egress-00
Htmlized:       https://datatracker.ietf.org/doc/html/draft-ymbk-sidrops-ov-egress

Abstract:
   It is useful fpr RPKI-based Origin Validation to classify and mark
   prefixes for all ingress, redistribution, and egress policies.  For
   egress policy, it is important that the classification uses the
   effective origin AS of the processed route, which may specifically be
   altered by the commonly available knobs such as removing private ASs,
   confederation handling, and other modifications of the origin AS.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Nick Hilliard <[email-masked]>
Date: Fri, 4 Jan 2019 13:53:38 +0000

>     confederation handling, and other modifications of the origin AS.

good point.  Are there any bgp stacks which currently implement this?

Nick

---

From: Ruediger Volk <[email-masked]>
Date: Fri, 04 Jan 2019 16:31:54 +0100

> good point.  Are there any bgp stacks which currently implement this?
all implementations relevant for my network (NOT an empty set) do NOT conform.

I guess the better question is:
which implementation actually do the right thing?
(congrats to the implementor!)

(and the next: what are the planned fixes?)
The draft does not change ROV, it just asks that application
in certain circumstance MUST be correct - that seem to be very
easy to neglect.

Most thinking about ROV application (and controlling correctnes of
route announcements) tends to focus on ingress policy.
I started late to seriously look at the egress - but I take
the robustnes principle serious - and in security matters
essentially the "be conservative" part applies.

When I started to consider requirements for my egress filtering
I hit the interesting cases, and immediately thought
"implementors most likely are missing these [corner?] cases"

Ruediger

---

From: Randy Bush <[email-masked]>
Date: Fri, 04 Jan 2019 10:53:21 -0800

> good point.  Are there any bgp stacks which currently implement this?

there are three i believe are working on it now

randy

---

From: Job Snijders <[email-masked]>
Date: Fri, 4 Jan 2019 21:59:24 +0300

Hi,

I’m appreciative the authors took the initiative for this draft. I’d like
this to be a working group item.

Kind regards,

Job

On Fri, Jan 4, 2019 at 18:35 Ruediger Volk <[email-masked]> wrote:

> _______________________________________________
> Sidrops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidrops
>

---

From: Randy Bush <[email-masked]>
Date: Fri, 04 Jan 2019 11:17:19 -0800

> I’m appreciative the authors took the initiative for this draft. I’d
> like this to be a working group item.

i suspect that the author will ask the wg chairs to do a wg adoption
call after it has simmered a bit and we have some feedback with content.

randy